This page tracks the Ubuntu fix status. The vulnerability itself is described on the main CVE page.
View CVE-2026-108726 →
UBUNTU-CVE-2026-108726
GLPI through 12.0.0 contains a missing authorization vulnerability in ajax/map.php that allows authenticated low-privileged users to search itemtypes...
Original description
The description as published by the source.
GLPI through 12.0.0 contains a missing authorization vulnerability in ajax/map.php that allows authenticated low-privileged users to search itemtypes they cannot view by omitting the canView() check. Attackers can submit crafted itemtype and search criteria for types like Contact, Supplier, Contract and Budget to obtain match counts, titles and coordinates within their entities.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Affected packages
Ubuntu:16.04:LTS
glpi
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
References
- report ubuntu.com
- report cve.org
- report github.com
- report github.com
- report hackmd.io
- report vulncheck.com